Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
09-05-2024 09:58
General
-
Target
297051f6830b2eb05bc0df7fa7aaf531_JaffaCakes118.exe
-
Size
590KB
-
MD5
297051f6830b2eb05bc0df7fa7aaf531
-
SHA1
f1789f45cd5771e1a41c59bf5bbce9bdeee33f88
-
SHA256
e24b14a6b6b94da0b5cd5db79e856d8ea9df6d8d1308971a59ed0ab202b45643
-
SHA512
dfe9054949788328a73f078e671c0c8993aaa6ef11076d065877b8256dfabf4ca5e4c2e6ec210fff8620db99d8823a6a3181d151bf40c7a867687b1c0d5820e8
-
SSDEEP
12288:D45BTx/i6u9xugEIyiPKDClYPa5/+CPcHDgy0S+Ckpo9wI9txMpwJXeu:sE6SIihYdqqNKpV
Malware Config
Extracted
limerat
359Z6KxMenwvgkA7vpGeBtinJPTj5raZz8
-
aes_key
arglobal
-
antivm
false
-
c2_url
https://pastebin.com/raw/CV5RHE9G
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/CV5RHE9G
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Drops startup file 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 35 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\297051f6830b2eb05bc0df7fa7aaf531_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\297051f6830b2eb05bc0df7fa7aaf531_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
488KB
-
Filesize
124KB
-
Filesize
200KB
-
Filesize
152KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
48KB
-
Filesize
124KB
-
Filesize
6.9MB
-
Filesize
616KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
48KB